Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

This privacy policy applies to all personal data processed in connection with your use of this website and your interactions with SALAMA LEGAL SLP. It has been prepared in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

2. Data We Collect

We collect personal data only where necessary and proportionate to the purposes described in this policy. The categories of data we may collect include:

• Contact form data: When you submit a message through our website contact form, we collect your name, email address, and the content of your message. You may also voluntarily provide your phone number, country of residence, preferred language, and the nature of your enquiry.
• Calendly scheduling data: If you book a consultation through our Calendly link, Calendly collects your name, email address, and any information you provide in the booking form. This data is processed by Calendly, Inc. under their own privacy policy.
• Analytics data: We do not use any analytics platform that collects personally identifiable information. If any analytics tools are deployed in future, this policy will be updated accordingly.
• Cookies: This website uses only technical/session cookies strictly necessary for the website to function. No advertising or profiling cookies are used. See our Cookie Policy for full details.
• Communications data: If you contact us by email, WhatsApp or telephone, we will retain a record of that communication for the purposes of managing our professional relationship.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Article 6(1)(b) — Pre-contractual relations: Processing is necessary in order to take steps at your request prior to entering into a contract for legal services. When you contact us to enquire about our services, we process your data to respond to your enquiry and assess whether we can assist you.
• Article 6(1)(f) — Legitimate interests: Processing is necessary for the purposes of our legitimate interests, namely managing our professional practice, maintaining records of client communications, and protecting ourselves and our clients in the event of a dispute. We have assessed that these interests are not overridden by your rights and freedoms.
• Article 6(1)(a) — Consent: Where we seek to send you marketing communications or newsletters (which we currently do not do), we will always ask for your explicit consent in advance.

4. How We Use Your Data

We use your personal data for the following purposes:

• To respond to enquiries and provide information about our legal services;
• To arrange and conduct consultations (by video call, phone, or in person);
• To deliver legal services where you become a client of SALAMA LEGAL SLP;
• To comply with our legal and regulatory obligations as a registered law firm in Spain;
• To maintain records required by Spanish professional regulations governing lawyers.

We will not use your data for direct marketing or send you promotional communications without your prior consent. We will not sell, rent or otherwise transfer your personal data to third parties for their own marketing purposes.

5. Data Retention

We retain personal data for as long as necessary for the purposes for which it was collected, subject to the following criteria:

• General enquiries that do not proceed to instruction: retained for up to 12 months from last contact, after which they are securely deleted.
• Client matter files and professional correspondence: retained for a minimum of 5 years following conclusion of the matter, in accordance with the professional obligations imposed by the Estatuto General de la Abogacía Española and applicable statute of limitations periods under Spanish law.
• Tax-related records: where required by Spanish tax law (Ley General Tributaria), relevant records may be retained for up to 10 years.

When the applicable retention period expires, data is securely deleted or anonymised.

6. Third-Party Processors

We engage a small number of third-party service providers who may process your personal data on our behalf or independently:

• Formcarry — our contact form is processed by Formcarry. Formcarry receives the data you submit through the contact form and forwards it to us. Their privacy policy is available at formcarry.com/privacy.
• Calendly, Inc. — we use Calendly to manage consultation scheduling. Calendly processes the data you provide when booking a call. Their privacy policy is available at calendly.com/privacy.
• Google Fonts — this website loads fonts from Google's CDN. Google may process your IP address in connection with font delivery. Google's privacy policy is available at policies.google.com/privacy.

We do not share your personal data with any other third parties except where required to do so by law or by a court or regulatory authority.

7. Your Rights Under GDPR

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access (Art. 15): you may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): you may ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): you may ask us to delete your data, subject to our legal obligations and legitimate interests in retaining it.
• Right to data portability (Art. 20): where processing is based on consent or contract and carried out by automated means, you may receive your data in a structured, machine-readable format.
• Right to object (Art. 21): you may object at any time to processing based on our legitimate interests.
• Right to restriction of processing (Art. 18): you may request that we restrict processing in certain circumstances.

To exercise any of these rights, please contact us at taxlegalspain@gmail.com. We will respond within one month of receiving your request.

You also have the right to lodge a complaint with the competent supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), accessible at www.aepd.es.

8. International Transfers

Some of our third-party service providers (in particular Formcarry and Calendly) are based in the United States. Transfers of personal data to these providers are carried out on the basis of:

• Standard Contractual Clauses (SCCs) as approved by the European Commission; and/or
• The provider's participation in the EU-US Data Privacy Framework where applicable.

You may request further information about the transfer mechanisms we rely upon by contacting us at taxlegalspain@gmail.com.

9. Security

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:

• All data transmissions to and from this website are encrypted using TLS/HTTPS;
• Access to personal data is restricted to Jacob Salama and any staff directly involved in handling your matter;
• Electronic files are password-protected and stored on secured systems.

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please notify us immediately at taxlegalspain@gmail.com.

10. Changes to this Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when this policy was last revised. We encourage you to review this page periodically. Where changes are material, we will take reasonable steps to bring them to your attention.

11. Contact Us

If you have any questions, concerns or requests regarding this privacy policy or the processing of your personal data, please contact us: